Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-S...

CVE-2023-2122 · published 3 years ago
Summary

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javas...

What to do
  • Update 10web image_optimizer to version 1.0.27 or later.
Affected software
VendorProductAffected versions
10web image_optimizer < 1.0.27
cpe:2.3:a:10web:image_optimizer:*:*:*:*:*:wordpress:*:*
Original advisory text
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-S...
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published16 Aug 2023
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-2122 · NVD
Track software like this
Free during beta